This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-87766 →

DEBIAN-CVE-2026-87766

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /...

Original description

The description as published by the source.

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 bubblewrap

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 bubblewrap

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1~deb13u1"}]}]

Debian:14 bubblewrap

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1"}]}]

References

advisory security-tracker.debian.org